From 924903196683e0d82844cd0c0e42434178b2af2f Mon Sep 17 00:00:00 2001 From: Nikolai R Kristiansen Date: Sun, 28 Feb 2016 15:09:13 +0100 Subject: [PATCH] Cleanups: remove ldap auth simplify settings --- .gitignore | 2 +- README.md | 2 +- neuf_userinfo/backends.py | 30 ----------------- requirements.txt | 1 - userinfosite/settings.py | 70 ++++----------------------------------- 5 files changed, 8 insertions(+), 97 deletions(-) delete mode 100644 neuf_userinfo/backends.py diff --git a/.gitignore b/.gitignore index 28786b9..394088e 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,6 @@ *.swp *.pyc -db.sqlite3 +*.sqlite3 static/style/.sass-cache/ local_settings.py venv diff --git a/README.md b/README.md index 8764b30..549e760 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ python manage.py runserver ## LDAP - sudo docker run -e LDAP_DOMAIN=neuf.no -e LDAP_ORGANISATION="Neuf" -e LDAP_ADMIN_PWD="toor" -p 389:389 -d nikolaik/openldap + docker run -e LDAP_DOMAIN=neuf.no -e LDAP_ORGANISATION="Neuf" -e LDAP_ADMIN_PWD="toor" -p 389:389 -d nikolaik/openldap ldapadd -D "cn=admin,dc=neuf,dc=no" -w "toor" -f test/testdata.ldif # Testdata # Verify import ldapsearch -x -b dc=neuf,dc=no diff --git a/neuf_userinfo/backends.py b/neuf_userinfo/backends.py deleted file mode 100644 index 0600b98..0000000 --- a/neuf_userinfo/backends.py +++ /dev/null @@ -1,30 +0,0 @@ -from django_auth_ldap.backend import LDAPBackend - - -class LDAPUsernameBackend(LDAPBackend): - settings_prefix = "AUTH_LDAP_U_" - - -class LDAPEmailBackend(LDAPBackend): - settings_prefix = "AUTH_LDAP_E_" - - def get_or_create_user(self, email, ldap_user): - """ - Use the PosixUser uid field as username instead of email. - - This must return a (User, created) 2-tuple for the given LDAP user. - username is the Django-friendly username of the user. ldap_user.dn is - the user's DN and ldap_user.attrs contains all of their LDAP attributes. - """ - model = self.get_user_model() - username_field = getattr(model, 'USERNAME_FIELD', 'username') - - kwargs = { - username_field + '__iexact': ldap_user.attrs['uid'][0], - 'defaults': { - username_field: ldap_user.attrs['uid'][0].lower(), - 'email': email - } - } - - return model.objects.get_or_create(**kwargs) \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 68e385f..dc3db83 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,5 +1,4 @@ Django==1.7.4 -django-auth-ldap==1.2.0 django-extensions==1.5.0 django-ldapdb==0.3.2 djangorestframework==3.0.5 diff --git a/userinfosite/settings.py b/userinfosite/settings.py index e5177e9..a31153b 100644 --- a/userinfosite/settings.py +++ b/userinfosite/settings.py @@ -1,11 +1,5 @@ """ -Django settings for this project. - -For more information on this file, see -https://docs.djangoproject.com/en/1.6/topics/settings/ - -For the full list of settings and their values, see -https://docs.djangoproject.com/en/1.6/ref/settings/ +Ref: https://docs.djangoproject.com/en/1.7/ref/settings/ """ # Build paths inside the project like this: os.path.join(BASE_DIR, ...) @@ -101,18 +95,12 @@ DATABASES = { 'PASSWORD': 'toor', }, 'radius': { - 'ENGINE': 'django.db.backends.mysql', - 'NAME': 'dev_radius', - 'USER': 'dev', - 'PASSWORD': 'dev', - 'HOST': 'localhost', + 'ENGINE': 'django.db.backends.sqlite3', + 'NAME': os.path.join(BASE_DIR, 'radius-db.sqlite3'), }, 'inside': { - 'ENGINE': 'django.db.backends.mysql', - 'NAME': 'dev_inside', - 'USER': 'dev', - 'PASSWORD': 'dev', - 'HOST': 'localhost', + 'ENGINE': 'django.db.backends.sqlite3', + 'NAME': os.path.join(BASE_DIR, 'inside-db.sqlite3'), } } DATABASE_ROUTERS = ['neuf_userinfo.router.Router'] @@ -145,58 +133,12 @@ DEFAULT_FROM_EMAIL = 'noreply@neuf.no' AUTHENTICATION_BACKENDS = ( 'inside.authentication.InsideBackend', - # 'neuf_userinfo.backends.LDAPEmailBackend', - # 'neuf_userinfo.backends.LDAPUsernameBackend', 'django.contrib.auth.backends.ModelBackend', ) # No cleaningladies. SESSION_EXPIRE_AT_BROWSER_CLOSE = True SESSION_COOKIE_AGE = 60 * 15 # in seconds -# LDAP server URI and BIND_DN, same as db-settings -AUTH_LDAP_U_SERVER_URI = DATABASES['ldap']['NAME'] -AUTH_LDAP_U_BIND_DN = DATABASES['ldap']['USER'] -AUTH_LDAP_U_BIND_PASSWORD = DATABASES['ldap']['PASSWORD'] - -import ldap -from django_auth_ldap.config import LDAPSearch, PosixGroupType - -# Basic user auth -AUTH_LDAP_U_USER_SEARCH = LDAPSearch(LDAP_USER_DN, ldap.SCOPE_ONELEVEL, "(uid=%(user)s)") -# Basic groups -AUTH_LDAP_U_GROUP_SEARCH = LDAPSearch(LDAP_GROUP_DN, ldap.SCOPE_ONELEVEL, "(objectClass=posixGroup)") -AUTH_LDAP_U_GROUP_TYPE = PosixGroupType() -# Mirror groups on each auth -AUTH_LDAP_U_MIRROR_GROUPS = True -# Group to user flag mappings -AUTH_LDAP_U_USER_FLAGS_BY_GROUP = { - "is_active": "cn=dns-alle,{}".format(LDAP_GROUP_DN), - "is_staff": "cn=edb,{}".format(LDAP_GROUP_DN), - "is_superuser": "cn=edbadmin,{}".format(LDAP_GROUP_DN) -} -# User attribute mappings -AUTH_LDAP_U_USER_ATTR_MAP = { - "first_name": "givenName", - "last_name": "sn", - "email": "mail", -} -# Allways update the django user object on authentication. -AUTH_LDAP_U_ALWAYS_UPDATE_USER = True - -# Email LDAP auth -AUTH_LDAP_E_SERVER_URI = AUTH_LDAP_U_SERVER_URI -AUTH_LDAP_E_BIND_DN = AUTH_LDAP_U_BIND_DN -AUTH_LDAP_E_BIND_PASSWORD = AUTH_LDAP_U_BIND_PASSWORD - -AUTH_LDAP_E_USER_SEARCH = LDAPSearch(LDAP_USER_DN, ldap.SCOPE_ONELEVEL, "(mail=%(user)s)") - -AUTH_LDAP_E_GROUP_SEARCH = AUTH_LDAP_U_GROUP_SEARCH -AUTH_LDAP_E_GROUP_TYPE = AUTH_LDAP_U_GROUP_TYPE -AUTH_LDAP_E_MIRROR_GROUPS = AUTH_LDAP_U_MIRROR_GROUPS -AUTH_LDAP_E_USER_FLAGS_BY_GROUP = AUTH_LDAP_U_USER_FLAGS_BY_GROUP -AUTH_LDAP_E_USER_ATTR_MAP = AUTH_LDAP_U_USER_ATTR_MAP -AUTH_LDAP_E_ALWAYS_UPDATE_USER = AUTH_LDAP_U_ALWAYS_UPDATE_USER - # Kerberos realm KERBEROS_REALM = "NEUF.NO" KERBEROS_ADMIN_PRINCIPAL = 'brukerinfo' @@ -244,4 +186,4 @@ CELERY_RESULT_SERIALIZER = 'json' try: from local_settings import * except ImportError: - pass \ No newline at end of file + pass